CVE-2026-60161Disclosure(oracle / vm_virtualbox)

LOWCVSS 6.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H).

oracle CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.oracle.com/security-alerts/cpujul2026.html

Weakness type (CWE)

CWE-362

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

vm_virtualbox

Threat summary

7 mentions across 5 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 4 classified signals
General: 3 classified signals
Peaked 3d ago at 3 mentions (2026-07-23); latest day: 1
7 total mentions across 5 days

Affected systems

Vendors

oracle

Products

vm_virtualbox

1 version affected across 1 product

Deep dive

Activity timeline7 mentions / 5d

Signal classification2 categories

Disclosure

457.1%

General

342.9%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-22	1	General1
2026-07-23	3	Disclosure2General1
2026-07-25	1	Disclosure1
2026-08-21	1	Disclosure1
2026-09-02	1	General1

Full discourse7 posts

Octane Security@octane_security90d
Disclosure
Following our responsible disclosure, @Oracle assigned CVE-2026-60161 to a memory corruption vulnerability Octane discovered in VirtualBox. VirtualBox is the world's most popular open-source virtualization software. Yet this bug went unnoticed for nearly 16 years. https://t.co/7oWLgNnbyO
Post summary
The statement announces the assignment of CVE‑2026‑60161 to a 16‑year‑old memory corruption flaw found in VirtualBox, highlighting the responsible disclosure process.
3122374145.0K
5.7K followersView on X
Octane Security@octane_security90d
Disclosure
CVE-2026-60161 full technical breakdown: http://www.octane.security/post/oracle-vm-virtualbox-bug-discovered-by-ai-cve-2026-60161
Post summary
The text announces CVE‑2026‑60161 and points to a link offering a full technical breakdown, indicating a vulnerability disclosure without evidence of exploitation or mitigation.
01092210
5.7K followersView on X
Octane Security@octane_security90d
General
This is open-source software, meaning anyone can read the code. And for nearly 16 years, people did. Oracle engineers, independent security researchers, even automated tooling. All of them had the full source in front of them. https://nvd.nist.gov/vuln/detail/CVE-2026-60161
Post summary
The statement notes that the software is open source and has been examined for many years, but it does not provide any vulnerability details, PoC, exploit code, patch information, or evidence of active exploitation.
10080228
5.7K followersView on X
Octane Security@octane_security49d
General
A warning only deters if it is credible. Octane's receipts are public: A high-severity bug in an Ethereum client running 38% of validators. Memory corruption in the engines behind 99.7% of browser traffic. A 16-year-old VirtualBox bug, CVE-2026-60161. CVE-2026-66022 in QEMU. https://t.co/xjZ8zu3knk
Post summary
The post lists several high‑severity bugs in widely used software but provides no evidence of exploitation, fixes, or disinformation.
1004071
5.7K followersView on X
cyberpigeon.eth@CyberpigeonB91d
General
@octane_security CVE-2026-60161
Post summary
The tweet simply mentions CVE‑2026‑60161 without any supporting details or context.
1003052
91 followersView on X
Shinka - AI@ShinkaIoT89d
Disclosure
AI just discovered a critical vulnerability in Oracle VirtualBox: CVE-2026-60161.🚨 This is a massive leap for AI in cybersecurity. It proves AI's capability to pinpoint complex software flaws. The era of AI-driven vulnerability research is here. Expect AI to redefine how we approach software security.
Post summary
The post alleges that AI discovered a new critical Oracle VirtualBox vulnerability (CVE-2026-60161) but provides no supporting evidence, technical details, or PoC.
0101171
1.8K followersView on X
Octane Security@octane_security61d
Disclosure
@noegrets3 @Oracle Any product that passes untrusted CUE/BIN images to an affected build could inherit the same host-side crash path. https://www.octane.security/post/oracle-vm-virtualbox-bug-discovered-by-ai-cve-2026-60161 https://t.co/YnWDeLDxAW
Post summary
The tweet announces the discovery of CVE-2026-60161 in Oracle VM VirtualBox, noting that untrusted images could trigger a host-side crash, but it does not provide PoC, exploitation code, or patch information.
0001073
5.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	oracle	vm_virtualbox	7.2.12	-	-

Explore more

Back to dashboard oracle CVEs vm_virtualbox vulnerabilities

What researchers are saying

CVE-2026-60161

Octane Security[verified]@octane_securityDisclosure

The statement announces the assignment of CVE‑2026‑60161 to a 16‑year‑old memory corruption flaw found in VirtualBox, highlighting the responsible disclosure process.

Octane Security[verified]@octane_securityDisclosure

The text announces CVE‑2026‑60161 and points to a link offering a full technical breakdown, indicating a vulnerability disclosure without evidence of exploitation or mitigation.

Octane Security[verified]@octane_securityGeneral

The statement notes that the software is open source and has been examined for many years, but it does not provide any vulnerability details, PoC, exploit code, patch information, or evidence of active exploitation.

Octane Security[verified]@octane_securityGeneral

The post lists several high‑severity bugs in widely used software but provides no evidence of exploitation, fixes, or disinformation.

cyberpigeon.eth[verified]@CyberpigeonBGeneral

The tweet simply mentions CVE‑2026‑60161 without any supporting details or context.

Shinka - AI[verified]@ShinkaIoTDisclosure

The post alleges that AI discovered a new critical Oracle VirtualBox vulnerability (CVE-2026-60161) but provides no supporting evidence, technical details, or PoC.

Octane Security[verified]@octane_securityDisclosure

The tweet announces the discovery of CVE-2026-60161 in Oracle VM VirtualBox, noting that untrusted images could trigger a host-side crash, but it does not provide PoC, exploitation code, or patch information.